chore(deps): bump the npm_and_yarn group across 7 directories with 9 updates by dependabot[bot] · Pull Request #4445 · rivet-dev/rivet

dependabot · 2026-03-17T19:50:33Z

Bumps the npm_and_yarn group with 9 updates in the / directory:

Package	From	To
qs	`6.14.1`	`6.14.2`
@hono/node-server	`1.14.2`	`1.19.10`
hono	`4.11.9`	`4.12.7`
ai	`4.3.19`	`5.0.52`
elysia	`1.4.12`	`1.4.27`
next	`16.1.1`	`16.1.7`
@modelcontextprotocol/sdk	`1.25.3`	`1.26.0`
tar	`7.5.7`	`7.5.11`
axios	`1.13.2`	`1.13.5`

Bumps the npm_and_yarn group with 1 update in the /examples/ai-and-user-generated-actors-freestyle/template directory: hono.
Bumps the npm_and_yarn group with 2 updates in the /examples/next-js directory: @hono/node-server and next.
Bumps the npm_and_yarn group with 2 updates in the /examples/react directory: @hono/node-server and hono.
Bumps the npm_and_yarn group with 2 updates in the /examples/react-vercel directory: @hono/node-server and hono.
Bumps the npm_and_yarn group with 3 updates in the /examples/sandbox directory: @hono/node-server, hono and ai.
Bumps the npm_and_yarn group with 3 updates in the /examples/sandbox-vercel directory: @hono/node-server, hono and ai.

Updates qs from 6.14.1 to 6.14.2

Changelog

Sourced from qs's changelog.

6.14.2

[Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)

[Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue

[Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)

[Fix] parse: enforce arrayLimit on comma-parsed values

[Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)

[Robustness] avoid .push, use void

[readme] document that addQueryPrefix does not add ? to empty output (#418)

[readme] clarify parseArrays and arrayLimit documentation (#543)

[readme] replace runkit CI badge with shields.io check-runs badge

[meta] fix changelog typo (arrayLength → arrayLimit)

[actions] fix rebase workflow permissions

Commits

bdcf0c7 v6.14.2
294db90 [readme] document that addQueryPrefix does not add ? to empty output
5c308e5 [readme] clarify parseArrays and arrayLimit documentation
6addf8c [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit
cfc108f [Fix] arrayLimit means max count, not max index, in combine/merge/`pars...
febb644 [Fix] parse: throw on arrayLimit exceeded with indexed notation when `thr...
f6a7abf [Fix] parse: enforce arrayLimit on comma-parsed values
fbc5206 [Fix] parse: fix error message to reflect arrayLimit as max index; remove e...
1b9a8b4 [actions] fix rebase workflow permissions
2a35775 [meta] fix changelog typo (arrayLength → arrayLimit)
Additional commits viewable in compare view

Updates @hono/node-server from 1.14.2 to 1.19.10

Release notes

Sourced from @hono/node-server's releases.

v1.19.10

Security Fix

Fixed an authorization bypass in Serve Static Middleware caused by inconsistent URL decoding (%2F handling) between the router and static file resolution. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-wc8c-qw6v-h7f6 for details.

v1.19.9

What's Changed

fix(globals): Stop overwriting global.fetch by @usualoma in honojs/node-server#295

Full Changelog: honojs/node-server@v1.19.8...v1.19.9

v1.19.8

What's Changed

docs: add guide for listening to UNIX domain socket by @TransparentLC in honojs/node-server#292

fix(serve-static): Use Readable.toWeb in serveStatic by @otya128 in honojs/node-server#293

New Contributors

@TransparentLC made their first contribution in honojs/node-server#292

@otya128 made their first contribution in honojs/node-server#293

Full Changelog: honojs/node-server@v1.19.7...v1.19.8

v1.19.7

What's Changed

fix: Fix for hono issue 4563 - incorrect content-length after following symlink by @tshmieldev in honojs/node-server#290

chore: add configVersion to bun.lock by @yusukebe in honojs/node-server#291

New Contributors

@tshmieldev made their first contribution in honojs/node-server#290

Full Changelog: honojs/node-server@v1.19.6...v1.19.7

v1.19.6

What's Changed

fix(serve-static): fix onFound timing by @usualoma in honojs/node-server#286

Full Changelog: honojs/node-server@v1.19.5...v1.19.6

v1.19.5

What's Changed

fix: cancel a readable stream if a writable stream is closed before a readable stream is closed. by @usualoma in honojs/node-server#280

Full Changelog: honojs/node-server@v1.19.4...v1.19.5

v1.19.4

... (truncated)

Commits

2f8ca36 1.19.10
455015b Merge commit from fork
cc05c48 chore: add benchmark for comparing with npm and local (dev) (#305)
58c4412 chore: Adding LICENSE file with MIT license referenced in README.md (#297)
b1daa4c docs(readme): add @usualoma as an author (#300)
26f5e89 1.19.9
2d729e7 fix(globals): Stop overwriting global.fetch (#295)
9b72ddf 1.19.8
0b1229e fix(serve-static): Use Readable.toWeb in serveStatic (#293)
76d80e6 docs: add guide for listening to UNIX domain socket (#292)
Additional commits viewable in compare view

Updates hono from 4.11.9 to 4.12.7

Release notes

Sourced from hono's releases.

v4.12.7

Security hardening

Ignore __proto__ path segments in parseBody({ dot: true }) to prevent potential prototype pollution when merged with unsafe patterns.

Full Changelog: honojs/hono@v4.12.6...v4.12.7

v4.12.6

What's Changed

fix(accept): replace regex split to mitigate ReDoS by @EdamAme-x in honojs/hono#4758

fix(jsx): align link hoisting and dedupe with React 19 by @usualoma in honojs/hono#4792

chore(builld): tsconfig project references by @BarryThePenguin in honojs/hono#4797

chore: add tsconfig.spec.json by @yusukebe in honojs/hono#4798

feat(jsx-renderer): support function-based options by @3w36zj6 in honojs/hono#4780

fix(lambda-edge): avoid callback handler deprecation on NODEJS_24_X by @t0waxx in honojs/hono#4782

New Contributors

@t0waxx made their first contribution in honojs/hono#4782

Full Changelog: honojs/hono@v4.12.5...v4.12.6

v4.12.5

What's Changed

fix(request): return string | undefined from param() when path type is any by @andrewdamelio in honojs/hono#4723

fix(jwt): validate token format in decode and decodeHeader functions by @otoneko1102 in honojs/hono#4752

fix(jsx): Fix "Invalid state: Controller is already closed" by @gaearon in honojs/hono#4770

chore(eslint): upgrade @hono/eslint-config by @BarryThePenguin in honojs/hono#4781

New Contributors

@andrewdamelio made their first contribution in honojs/hono#4723

@otoneko1102 made their first contribution in honojs/hono#4752

@gaearon made their first contribution in honojs/hono#4770

Full Changelog: honojs/hono@v4.12.4...v4.12.5

v4.12.4

Security fixes

This release includes fixes for the following security issues:

SSE Control Field Injection

Affects: streamSSE() in Streaming Helper. Fixes injection of unintended SSE fields by rejecting CR/LF characters in event, id, and retry. GHSA-p6xx-57qc-3wxr

Cookie Attribute Injection in setCookie()

Affects: setCookie() from hono/cookie. Fixes cookie attribute manipulation by rejecting ;, \r, and \n in domain and path options. GHSA-5pq2-9x2x-5p6w

... (truncated)

Commits

b0aba5b 4.12.7
1be3a53 ci: apply automated fixes
ef90225 Merge commit from fork
3f88636 4.12.6
53b66ae fix(lambda-edge): avoid callback handler deprecation on NODEJS_24_X (#4782)
58825a7 feat(jsx-renderer): support function-based options (#4780)
0e80acb chore: add tsconfig.spec.json (#4798)
d69deb8 chore(builld): tsconfig project references (#4797)
8217d9e fix(jsx): align link hoisting and dedupe with React 19 (#4792)
5086956 fix(accept): replace regex split to mitigate ReDoS (#4758)
Additional commits viewable in compare view

Updates ai from 4.3.19 to 5.0.52

Commits

63d5f66 Version Packages (#8895)
930399b Backport: fix(ai): download files when intermediate file cannot be downloaded...
7ca78f1 Backport: feat(provider/gateway): Add new Qwen models to Gateway model string...
1cfc209 Backport: feat(provider/openai): OpenAILanguageModelOptions type (#8858)
347b7ec ci: rename v5.0 branch to release-v*
85909a9 Backport: chore(ai): update test message (#8875)
c56822d Backport: fix(ai): update uiMessageChunkSchema to satisfy the `UIMessageChu...
1461adf Backport: chore(examples): remove redundant OpenAI reasoning examples (#8871)
6bd07df Version Packages (#8853)
a45d61a ci(release): remove incorrect changeset bump for @ai-sdk/baseten
Additional commits viewable in compare view

Updates elysia from 1.4.12 to 1.4.27

Release notes

Sourced from elysia's releases.

1.4.27

What's changed

Bug fix:

getSchemaValidator: handle TypeBox as sub type

handle cookie prototype pollution when parsing cookie

Improvement:

conditional async on getSchemaValidator when schema is Standard Schema

use Response.json on Bun

export AnySchema, UnwrapSchema, ModelsToTypes from root

Full Changelog: elysiajs/elysia@1.4.26...1.4.27

1.4.26

What's changed

Bug fix:

#1755 deduplicate local handler from global event

#1752 system router with trailing path doesn't match with non-trailing

url format redos

#1747 parsing request from mount hang

Full Changelog: elysiajs/elysia@1.4.25...1.4.26

1.4.25

What's changed

Feature:

export ElysiaStatus

Bug fix:

macro with conflict literal value per status

recursive macro with conflict value per status

Full Changelog: elysiajs/elysia@1.4.24...1.4.25

1.4.24

What's Changed

Feature:

graceful unsigned cookie transition

Bug fix:

#1733 preserve multiple set-cookie headers in mounted handlers by @cipher416

object cookie with secret doesn't deserialized after parsed

New Contributors

@cipher416 made their first contribution in elysiajs/elysia#1733

Full Changelog: elysiajs/elysia@1.4.23...1.4.24

... (truncated)

Changelog

Sourced from elysia's changelog.

1.4.27 - 1 Mar 2026

Bug fix:

getSchemaValidator: handle TypeBox as sub type

handle cookie prototype pollution when parsing cookie

Improvement:

conditional async on getSchemaValidator when schema is Standard Schema

use Response.json on Bun

1.4.26 - 25 Feb 2026

Bug fix:

#1755 deduplicate local handler from global event

#1752 system router with trailing path doesn't match with non-trailing

url format redos

#1747 parsing request from mount hang

1.4.25 - 12 Feb 2026

Feature:

export ElysiaStatus

Bug fix:

macro with conflict literal value per status

recursive macro with conflict value per status

1.4.24 - 11 Feb 2026

Feature:

graceful unsigned cookie transition

Bug fix:

#1733 preserve multiple set-cookie headers in mounted handlers

object cookie with secret doesn't deserialized after parsed

1.4.23 - 9 Feb 2026

Feature:

#1719 add t.Union/t.Intersection handling in property enumerations/checks

#1697 extend complex formdata support to StandardSchema

#1656 serialize custom array-like custom class with array sub class

Bug fix:

#1721 Promise with response schema

#1700 distinct union object

#1683 response validation returns 500 instead of 422 for nested schemas in dynamic mode

#1679 preserve headers when throwing from AsyncGenerator

#1595 stream reference should point to teed value

fix can't modify immutable headers error

Change:

update exact-mirror to 0.2.7

1.4.22 - 14 Jan 2026

... (truncated)

Commits

cc9159b 🎉 feat: 1.4.27
e9d6b17 🎉 feat: 1.4.27
21dce4c 🎉 feat: use Response.json on Bun
6b44646 🔧 fix(getSchemaValidator): handle TypeBox as sub type
bbaf6b7 🎉 feat: 1.4.26
e596dab 🔧 fix: #1747 parsing request from mount hang
6561d61 🔧 fix: #1752 system router with trailing path doesn't match with non-t...
3c9dabc 🔧 fix: #1752 system router with trailing path doesn't match with non-t...
d17a7aa 🔧 fix: #1755 deduplicate local handler from global event
e5c9449 🔧 fix: recursive macro with conflict value per status
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for elysia since your current version.

Updates next from 16.1.1 to 16.1.7

Release notes

Sourced from next's releases.

v16.1.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[Cache Components] Prevent streaming fetch calls from hanging in dev (#89194)

Apply server actions transform to node_modules in route handlers (#89380)

ensure maxPostponedStateSize is always respected (See: CVE-2026-27979)

feat(next/image): add lru disk cache and images.maximumDiskCacheSize (See: CVE-2026-27980)

Allow blocking cross-site dev-only websocket connections from privacy-sensitive origins (See: CVE-2026-27977)

Disallow Server Action submissions from privacy-sensitive contexts by default (See: CVE-2026-27978)

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @unstubbable, @styfle, @eps1lon, and @ztanner for helping!

v16.1.6

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Upgrade to swc 54 (#88207)

implement LRU cache with invocation ID scoping for minimal mode response cache (#88509)

tweak LRU sentinel key (#89123)

Credits

Huge thanks to @mischnic, @wyattjoh, and @ztanner for helping!

v16.1.5

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472 https://vercel.com/changelog/summary-of-cve-2026-23864

Commits

bdf3e35 v16.1.7
dc98c04 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
9023c0a [backport] Disallow Server Action submissions from privacy-sensitive contexts...
36a97b9 Allow blocking cross-site dev-only websocket connections from privacy-sensiti...
93c3993 [backport]: feat(next/image): add lru disk cache and `images.maximumDiskCache...
c68d62d Backport documentation fixes for 16.1.x (#90655)
5214ac1 [backport]: ensure maxPostponedStateSize is always respected (#90060) (#90471)
c95e357 Backport/docs fixes 16.1.x (#90125)
cba6144 [backport] Apply server actions transform to node_modules in route handlers...
3db9063 [backport] [Cache Components] Prevent streaming fetch calls from hanging in d...
Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.25.3 to 1.26.0

Release notes

Sourced from @modelcontextprotocol/sdk's releases.

v1.26.0

Addresses "Sharing server/transport instances can leak cross-client response data" in this GHSA GHSA-345p-7cg4-v4c7

What's Changed

chore: bump v1.25.3 for backport fixes by @pcarleton in modelcontextprotocol/typescript-sdk#1412

fix(deps): resolve npm audit vulnerabilities and bump dependencies (v1.x backport) by @samuv in modelcontextprotocol/typescript-sdk#1382

Fix #1430: Client Credentials providers scopes support (backported) by @NSeydoux in modelcontextprotocol/typescript-sdk#1442

chore: bump version to 1.26.0 by @pcarleton in modelcontextprotocol/typescript-sdk#1479

New Contributors

@samuv made their first contribution in modelcontextprotocol/typescript-sdk#1382

@NSeydoux made their first contribution in modelcontextprotocol/typescript-sdk#1442

Full Changelog: modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0

Commits

fe9c07b chore: bump version to 1.26.0 (#1479)
4f01e7e fix: add non-null assertions for optional setupServer fields in stateful test
a05be17 Merge commit from fork
50d9fa3 Fix #1430: Client Credentials providers scopes support (backported) (#1442)
aa81a66 fix(deps): resolve npm audit vulnerabilities and bump dependencies (v1.x back...
6aba065 chore: bump v1.25.3 for backport fixes (#1412)
See full diff in compare view

Updates tar from 7.5.7 to 7.5.11

Commits

bf776f6 7.5.11
f48b5fa prevent escaping symlinks with drive-relative paths
97cff15 docs: more security info
2b72abc 7.5.10
7bc755d parse root off paths before sanitizing .. parts
c8cb846 update deps
1f0c2c9 7.5.9
fbb0851 build minified version as default export
6b8eba0 7.5.8
2cb1120 fix(unpack): improve UnpackSync symlink error "into" path accuracy
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates axios from 1.13.2 to 1.13.5

Release notes

Sourced from axios's releases.

v1.13.5

Release 1.13.5

Highlights

Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)

Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

Fixes

Fix/5657. (PR #7313)

Ensure status is present in AxiosError on and after v1.13.3. (PR #7368)

Features / Improvements

Add input validation to isAbsoluteURL. (PR #7326)

Refactor: bump minor package versions. (PR #7356)

Documentation

Clarify object-check comment. (PR #7323)

Fix deprecated Buffer constructor usage and README formatting. (PR #7371)

CI / Maintenance

Chore: fix issues with YAML. (PR #7355)

CI: update workflow YAMLs. (PR #7372)

CI: fix run condition. (PR #7373)

Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR #7360)

Chore(release): prepare release 1.13.5. (PR #7379)

New Contributors

@sachin11063 (first contribution — PR #7323)

@asmitha-16 (first contribution — PR #7326)

Full Changelog: axios/axios@v1.13.4...v1.13.5

v1.13.4

Overview

The release addresses issues discovered in v1.13.3 and includes significant CI/CD improvements.

Full Changelog: v1.13.3...v1.13.4

What's New in v1.13.4

Bug Fixes

fix: issues with version 1.13.3 (#7352) (ee90dfc)

Fixed issues discovered in v1.13.3 release

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

1.13.3 (2026-01-20)

Bug Fixes

http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)

interceptor: handle the error in the same interceptor (#6269) (5945e40)

main field in package.json should correspond to cjs artifacts (#5756) (7373fbf)

package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (#5754) (b89217e)

silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) (7d19335)

turn AxiosError into a native error (#5394) (#5558) (1c6a86d)

types: add handlers to AxiosInterceptorManager interface (#5551) (8d1271b)

types: restore AxiosError.cause type from unknown to Error (#7327) (d8233d9)

unclear error message is thrown when specifying an empty proxy authorization (#6314) (6ef867e)

Features

add undefined as a value in AxiosRequestConfig (#5560) (095033c)

add automatic minor and patch upgrades to dependabot (#6053) (65a7584)

add Node.js coverage script using c8 (closes #7289) (#7294) (ec9d94e)

added copilot instructions (3f83143)

compatibility with frozen prototypes (#6265) (860e033)

enhance pipeFileToResponse with error handling (#7169) (88d7884)

types: Intellisense for string literals in a widened union (#6134) (f73474d), closes microsoft/TypeScript#33471

Reverts

Revert "fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7…" (#7298) (a4230f5), closes #7253 #7 #7298

deps: bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (#7334) (2d6ad5e)

Contributors to this release

Ashvin Tiwari

Nikunj Mochi

Anchal Singh

jasonsaayman

Julian Dax

Akash Dhar Dubey

Madhumita

Tackoil

Justin Dhillon

Rudransh

WuMingDao

codenomnom

Nandan Acharya

Eric Dubé

Tibor Pilz

Gabriel Quaresma

Turadg Aleahmad

... (truncated)

Commits

29f7542 chore(release): prepare release 1.13.5 (#7379)
431c3a3 ci: fix run condition (#7373)
9ff3a78 ci: update ymls (#7372)
265b712 docs: fix deprecated Buffer constructor and formatting issues in README (#7371)
475e75a feat: add input validation to isAbsoluteURL (#7326)
28c7215 fix: Denial of Service via proto Key in mergeConfig (#7369)
04cf019 docs: clarify object check comment (#7323)
696fa75 fix: status is missing in AxiosError on and after v1.13.3 (#7368)
569f028 fix: added a option to choose between legacy and the new request/response int...
44b7c9f chore(deps-dev): bump karma-sourcemap-loader (#7360)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for axios since your current version.

Updates hono from 4.9.8 to 4.12.7

Release notes

Sourced from hono's releases.

v4.12.7

Security hardening

Ignore __proto__ path segments in parseBody({ dot: true }) to prevent potential prototype pollution when merged with unsafe patterns.

Full Changelog: honojs/hono@v4.12.6...v4.12.7

v4.12.6

What's Changed

fix(accept): replace regex split to mitigate ReDoS by @EdamAme-x in honojs/hono#4758

fix(jsx): align link hoisting and dedupe with React 19 by @usualoma in honojs/hono#4792

chore(builld): tsconfig project references by @BarryThePenguin in honojs/hono#4797

chore: add tsconfig.spec.json by @yusukebe in honojs/hono#4798

feat(jsx-renderer): support function-based options by @3w36zj6 in honojs/hono#4780

fix(lambda-edge): avoid callback handler deprecation on NODEJS_24_X by @t0waxx in honojs/hono#4782

New Contributors

@t0waxx made their first contribution in honojs/hono#4782

Full Changelog: honojs/hono@v4.12.5...v4.12.6

v4.12.5

What's Changed

fix(request): return string | undefined from param() when path type is any by @andrewdamelio in honojs/hono#4723

fix(jwt): validate token format in decode and decodeHeader functions by @otoneko1102 in honojs/hono#4752

fix(jsx): Fix "Invalid state: Controller is already closed" by @gaearon in honojs/hono#4770

chore(eslint): upgrade @hono/eslint-config by @BarryThePenguin in honojs/hono#4781

New Contributors

@andrewdamelio made their first contribution in honojs/hono#4723

@otoneko1102 made their first contribution in honojs/hono#4752

@gaearon made their first contribution in honojs/hono#4770

Full Changelog: honojs/hono@v4.12.4...v4.12.5

v4.12.4

Security fixes

This release includes fixes for the following security issues:

SSE Control Field Injection

Affects: streamSSE() in Streaming Helper. Fixes injection of unintended SSE fields by rejecting CR/LF characters in event, id, and retry. GHSA-p6xx-57qc-3wxr

Cookie Attribute Injection in setCookie()

Affects: setCookie() from hono/cookie. Fixes cookie attribute manipulation by rejecting ;, \r, and \n in domain and path options. GHSA-5pq2-9x2x-5p6w

... (truncated)

Commits

b0aba5b 4.12.7
1be3a53 ci: apply automated fixes
ef90225 Merge commit from fork
3f88636 4.12.6
53b66ae fix(lambda-edge): avoid callback handler deprecation on NODEJS_24_X (#4782)
58825a7 feat(jsx-renderer): support function-based options (#4780)
0e80acb chore: add tsconfig.spec.json (#4798)
d69deb8 chore(builld): tsconfig project references (#4797)
8217d9e fix(jsx): align link hoisting and dedupe with React 19 (#4792)
5086956 fix(accept): replace regex split to mitigate ReDoS (#4758)
Additional commits viewable in compare view

Updates @hono/node-server from 1.14.2 to 1.19.10

Release notes

Sourced from

…updates Bumps the npm_and_yarn group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [qs](https://github.com/ljharb/qs) | `6.14.1` | `6.14.2` | | [@hono/node-server](https://github.com/honojs/node-server) | `1.14.2` | `1.19.10` | | [hono](https://github.com/honojs/hono) | `4.11.9` | `4.12.7` | | [ai](https://github.com/vercel/ai) | `4.3.19` | `5.0.52` | | [elysia](https://github.com/elysiajs/elysia) | `1.4.12` | `1.4.27` | | [next](https://github.com/vercel/next.js) | `16.1.1` | `16.1.7` | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.25.3` | `1.26.0` | | [tar](https://github.com/isaacs/node-tar) | `7.5.7` | `7.5.11` | | [axios](https://github.com/axios/axios) | `1.13.2` | `1.13.5` | Bumps the npm_and_yarn group with 1 update in the /examples/ai-and-user-generated-actors-freestyle/template directory: [hono](https://github.com/honojs/hono). Bumps the npm_and_yarn group with 2 updates in the /examples/next-js directory: [@hono/node-server](https://github.com/honojs/node-server) and [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 2 updates in the /examples/react directory: [@hono/node-server](https://github.com/honojs/node-server) and [hono](https://github.com/honojs/hono). Bumps the npm_and_yarn group with 2 updates in the /examples/react-vercel directory: [@hono/node-server](https://github.com/honojs/node-server) and [hono](https://github.com/honojs/hono). Bumps the npm_and_yarn group with 3 updates in the /examples/sandbox directory: [@hono/node-server](https://github.com/honojs/node-server), [hono](https://github.com/honojs/hono) and [ai](https://github.com/vercel/ai). Bumps the npm_and_yarn group with 3 updates in the /examples/sandbox-vercel directory: [@hono/node-server](https://github.com/honojs/node-server), [hono](https://github.com/honojs/hono) and [ai](https://github.com/vercel/ai). Updates `qs` from 6.14.1 to 6.14.2 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.1...v6.14.2) Updates `@hono/node-server` from 1.14.2 to 1.19.10 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.14.2...v1.19.10) Updates `hono` from 4.11.9 to 4.12.7 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.11.9...v4.12.7) Updates `ai` from 4.3.19 to 5.0.52 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/compare/ai@4.3.19...ai@5.0.52) Updates `elysia` from 1.4.12 to 1.4.27 - [Release notes](https://github.com/elysiajs/elysia/releases) - [Changelog](https://github.com/elysiajs/elysia/blob/main/CHANGELOG.md) - [Commits](elysiajs/elysia@1.4.12...1.4.27) Updates `next` from 16.1.1 to 16.1.7 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v16.1.1...v16.1.7) Updates `@modelcontextprotocol/sdk` from 1.25.3 to 1.26.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0) Updates `tar` from 7.5.7 to 7.5.11 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.7...v7.5.11) Updates `axios` from 1.13.2 to 1.13.5 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.13.2...v1.13.5) Updates `hono` from 4.9.8 to 4.12.7 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.11.9...v4.12.7) Updates `@hono/node-server` from 1.14.2 to 1.19.10 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.14.2...v1.19.10) Updates `next` from 16.1.1 to 16.1.7 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v16.1.1...v16.1.7) Updates `@hono/node-server` from 1.19.7 to 1.19.10 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.14.2...v1.19.10) Updates `hono` from 4.11.3 to 4.12.7 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.11.9...v4.12.7) Updates `@hono/node-server` from 1.19.7 to 1.19.10 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.14.2...v1.19.10) Updates `hono` from 4.11.3 to 4.12.7 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.11.9...v4.12.7) Updates `@hono/node-server` from 1.14.2 to 1.19.10 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.14.2...v1.19.10) Updates `hono` from 4.11.9 to 4.12.7 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.11.9...v4.12.7) Updates `ai` from 4.3.19 to 5.0.52 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/compare/ai@4.3.19...ai@5.0.52) Updates `@hono/node-server` from 1.14.2 to 1.19.10 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.14.2...v1.19.10) Updates `hono` from 4.11.9 to 4.12.7 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.11.9...v4.12.7) Updates `ai` from 4.3.19 to 5.0.52 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/compare/ai@4.3.19...ai@5.0.52) --- updated-dependencies: - dependency-name: qs dependency-version: 6.14.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@hono/node-server" dependency-version: 1.19.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: ai dependency-version: 5.0.52 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: elysia dependency-version: 1.4.27 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.1.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.26.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.13.5 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@hono/node-server" dependency-version: 1.19.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.1.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@hono/node-server" dependency-version: 1.19.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@hono/node-server" dependency-version: 1.19.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@hono/node-server" dependency-version: 1.19.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: ai dependency-version: 5.0.52 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@hono/node-server" dependency-version: 1.19.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: ai dependency-version: 5.0.52 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

pkg-pr-new · 2026-03-17T19:54:40Z

More templates

@rivetkit/cloudflare-workers

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/cloudflare-workers@4445

@rivetkit/framework-base

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/framework-base@4445

@rivetkit/next-js

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/next-js@4445

@rivetkit/react

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/react@4445

rivetkit

pnpm add https://pkg.pr.new/rivet-dev/rivet/rivetkit@4445

@rivetkit/sql-loader

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/sql-loader@4445

@rivetkit/sqlite-vfs

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/sqlite-vfs@4445

@rivetkit/traces

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/traces@4445

@rivetkit/workflow-engine

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/workflow-engine@4445

@rivetkit/virtual-websocket

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/virtual-websocket@4445

@rivetkit/engine-runner

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/engine-runner@4445

@rivetkit/engine-runner-protocol

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/engine-runner-protocol@4445

commit: 7ddd28e

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 17, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 7 directories with 9 updates#4445

chore(deps): bump the npm_and_yarn group across 7 directories with 9 updates#4445
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-ac7f1277b8

dependabot bot commented on behalf of github Mar 17, 2026

Uh oh!

pkg-pr-new bot commented Mar 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Mar 17, 2026

6.14.2

v1.19.10

Security Fix

v1.19.9

What's Changed

v1.19.8

What's Changed

New Contributors

v1.19.7

What's Changed

New Contributors

v1.19.6

What's Changed

v1.19.5

What's Changed

v1.19.4

v4.12.7

Security hardening

v4.12.6

What's Changed

New Contributors

v4.12.5

What's Changed

New Contributors

v4.12.4

Security fixes

SSE Control Field Injection

Cookie Attribute Injection in setCookie()

1.4.27

What's changed

1.4.26

What's changed

1.4.25

What's changed

1.4.24

What's Changed

New Contributors

1.4.27 - 1 Mar 2026

1.4.26 - 25 Feb 2026

1.4.25 - 12 Feb 2026

1.4.24 - 11 Feb 2026

1.4.23 - 9 Feb 2026

1.4.22 - 14 Jan 2026

v16.1.7

Core Changes

Credits

v16.1.6

Core Changes

Credits

v16.1.5

v1.26.0

What's Changed

New Contributors

v1.13.5

Release 1.13.5

Highlights

Changes

Security

Fixes

Features / Improvements

Documentation

CI / Maintenance

New Contributors

v1.13.4

Overview

What's New in v1.13.4

Bug Fixes

Changelog

1.13.3 (2026-01-20)

Bug Fixes

Features

Reverts

Contributors to this release

v4.12.7

Security hardening

v4.12.6

What's Changed

New Contributors

Cookie Attribute Injection in `setCookie()`

Cookie Attribute Injection in `setCookie()`